TIBCO Security Advisory: January 11, 2022 - TIBCO eFTL -2021-43054

TIBCO eFTL Token Generation Vulnerability Original release date: January 11, 2022 Last revised:--- CVE-2021-43054 Source: TIBCO SoftwareInc. Products Affected TIBCO eFTL - Community Edition versions 6.7.2 and below TIBCO eFTL - Developer Edition versions 6.7.2 and below TIBCO eFTL - Enterprise...

USN-5208-1: Linux kernel vulnerabilities

Nadav Amit discovered that the hugetlb implementation in the Linux kernel did not perform TLB flushes under certain conditions. A local attacker could use this to leak or alter data from other processes that use huge pages. CVE-2021-4002 It was discovered that a race condition existed in the...

CVE-2022-22116

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...

CVE-2021-42061: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform Web Intelligence - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. Flex Local Fonts plugin is a WordPress open source application plugin. WordPress Flex Local Fonts plugin in version...

CVE-2020-12890

Improper handling of pointers in the System Management Mode SMM handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture AGESA to execute arbitrary code undetected by the operating system...

Input validation

Improper handling of pointers in the System Management Mode SMM handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture AGESA to execute arbitrary code undetected by the operating system...

CVE-2020-12890

Improper handling of pointers in the System Management Mode SMM handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture AGESA to execute arbitrary code undetected by the operating system...

CVE-2020-12890: Undefined Security Weakness

Improper handling of pointers in the System Management Mode SMM handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture AGESA to execute arbitrary code undetected by the operating system...

SUSE: Security Advisory (SUSE-SU-2021:3835-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:3836-1 Security update for mariadb

This update for mariadb fixes the following issues: - Update to 10.4.22: - CVE-2021-35604: Fixed InnoDB vulnerability that allowed an high privileged attacker with network access via multiple protocols to compromise MySQL bsc1192497. - Add missing dependency to liblz4 to enable lz4 compression fo...

gnome-shell 安全漏洞

gnome-shell is a shell that provides core user interface functionality such as switching windows, launching applications or viewing notifications for the GNOME desktop. A security vulnerability exists in gnome-shell, where an attacker with low privileged privileges may be able to exploit the...

CVE-2021-36313

Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

Command injection

Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

CVE-2021-36313: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

CVE-2021-36334: Improper Neutralization of Formula Elements in a CSV File

Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine...

Cross site scripting

The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts...

PT-2021-6679 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to a buffer overflow in the memory of the MySQL...

PT-2021-6674 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to a stack-based buffer overflow in the MySQL...

PT-2021-6990 · Oracle +1 · Oracle Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Cluster versions 8.0.28 and prior Description: The issue is related to insufficient input validation in the Oracle MySQL Cluster component. It may allow an attacker to gain full control over the application using various network...